[ZOOKEEPER-3677] owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer

• Type: Task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.7.0, 3.5.7, 3.6.1
• Component/s: security
• Labels: pull-request-available
• Hadoop Flags: Reviewed
• Assignee: Enrico Olivelli
• Reporter: Patrick D. Hunt
• Created: 07/Jan/20 20:22
• Updated: 14/Mar/22 17:30
• Resolved: 18/Jan/20 22:10

Description

Doesn't look like this impacts us (we don't use SocketServer) however we should figure out what to do as the owasp checker is failing and the rating is quite high (9.8 - bound to get interest)

https://nvd.nist.gov/vuln/detail/CVE-2019-17571

Perhaps ZOOKEEPER-2342 should be prioritized.

Issue Links

• is duplicated by: ZOOKEEPER-4305 log4j CVE problem
• is duplicated by: ZOOKEEPER-3990 Log4j 1.2.17 used by zookeeper 3.6.1 is vulnerable to CVE-2019-17571
• is fixed by: ZOOKEEPER-2342 Migrate to Log4J 2.
• links to: GitHub Pull Request #1209